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IN THE CLAIMS : 

Please amend claims as follows: 
Claims 1-128 are cancelled 

129. (Currently Amended) A method, comprising: 

collecting a plurality of transmission events provided by 
one or more nodes of a network into one or more data 
structures; and 

creating one or more characterization records for at least 
one data structure of said one or more data structures, one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures, wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements stored in said one or more data structures and 
comprising a substantive content or a message comprised in at 
least one of said one or more transmission events, to allow 
accessing said at least one of the one or more characterization 
records to determine said one or more indicators of the location 
or locations of said one or more data elements. 

13 0. (Previously Presented) The method of claim 129, wherein 
said collecting and said creating is performed by a site of a 
plurality of sites comprised in said network. 

131. (Previously Presented) The method of claim 129, wherein 
said one or more data elements are stored within said at least 
one data structure. 
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132. (Previously Presented) The method of claim 129, wherein 
said collecting comprises creating observation records of said 
plurality of the transmission events and storing said 
observation records in said one or more data structures, such 
that said at least one data structure of said one or more data 
structures comprises one or more observation records of said 
observation records created using one or more transmission 
events of said plurality of the transmission events, said one 
or more observation records being generated using one or more 
characteristics of said one or more transmission events in order 
to allow entering said one or more observation records to 
determine whether at least one of said one or more 
characteristics is present in said at least one data structure. 

133. (Previously Presented) The method of claim 132, wherein 
said one or more characteristics of said one or more 
transmission events are one or more of: a period during which a 
transmission event of said one or more transmission events is 
occurred, and an internet protocol address of a node of said one 
or more nodes transmitted said transmission event. 

134. (Previously Presented) The method of claim 132, wherein 
said at least one of said one or more characterization records 
is an index created using said one or more observation records. 

135. (Previously Presented) The method of claim 129, wherein 
said at least one of said one or more characterization records 
is an index comprising one or more of: a type of or an 
importance level for a transmission event of said one or more 
transmission events of said plurality of the transmission 
events, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event, and an internet 
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protocol address of a node of said one or more nodes being a 
destination of said transmission event. 

136. (Currently Amended) The method of claim 129, wherein said 
at least one of said one or more characterization records is an 
index indicating how to enter said location or locations of one 
or more data elements comprising at least one of said one or 
more transmission events unabridged. 

137. (Preciously Presented) The method of claim 129, wherein 
said one or more characterization records comprise a summary of 
said one or more transmission events of said plurality of the 
transmission events. 

138. (Preciously Presented) The method of claim 129, wherein at 
least one of said plurality of the transmission events is a 
notification. 

139. (Preciously Presented) The method of claim 129, wherein 
said one or more data elements comprise partial or complete data 
comprised in said at least one of the one or more transmission 
events . 

140. (Preciously Presented) The method of claim 129, further 
comprising: 

storing said one or more data structures comprising 
corresponding said one or more characterization records in a 
memory, in a non-volatile memory or in a data storage. 

141. (Preciously Presented) The method of claim 129, further 
comprising : 
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storing said one or more data structures with corresponding 
characterization records as a file system or as a hierarchical 
file system. 

142. (Preciously Presented) The method of claim 129, wherein one 
of said one or more characterization records comprise an 
aggregate summary of said at least one data structure and one or 
more of other data structures of said one or more data 
structures . 

143. (Preciously Presented) The method of claim 129, wherein 
said network is configured to provide network activity data in a 
computer system comprising a plurality of nodes interconnected 
for communicating via said network. 

144. (Preciously Presented) The method of claim 129, wherein all 
or selected transmission events of said plurality of the 
transmission events are notifications provided by all or 
selected nodes of said one or more nodes of said network. 

145. (Preciously Presented) The method of claim 129, wherein 
said location or said locations of the one or more data elements 
are in said at least one data structure of said one or more data 
structures . 

146. (Preciously Presented) The method of claim 129, further 
comprising : 

performing compression of said at least one data structure. 

147. (Preciously Presented) The method of claim 129, further 
comprising : 
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creating a digital signature of said at least one data 
structure . 

148. (Currently Amended) An apparatus comprising: 

a first controller, configured to perform collecting a 
plurality of transmission events provided by one or more nodes 
of a network into one or more data structures; and 

a second controller, configured to create one or more 
characterization records for at least one data structure of said 
one or more data structures, one or more transmission events of 
said plurality of the transmission events being collected to 
said at least one data structure of said one or more data 
structures, wherein at least one of said one or more 
characterization records comprises one or more indicators of a 
location or locations of one or more data elements stored in 
said one or more data structures and comprising a substantive 
content or a message comprised in at least one of said one or 
more transmission events, to allow accessing said at least one 
of the one or more characterization records to determine said 
one or more indicators of the location or locations of said one 
or more data elements. 

14 9. (Preciously Presented) The apparatus of claim 148, wherein 
said first controller is configured to perform said collecting 
by creating observation records of said plurality of the 
transmission events for storing said observation records in said 
one or more data structures, such that said at least one data 
structure of said one or more data structures comprises one or 
more observation records of said observation records created 
using one or more transmission events of said plurality of the 
transmission events, said one or more observation records being 
generated using one or more characteristics of said one or more 
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transmission events in order to allow entering said one or more 
observation records to determine whether at least one of said 
one or more characteristics is present in said at least one data 
structure . 

150. (Preciously Presented) The apparatus of claim 149, further 
comprising : 

a memory, configured to store said one or more data 
structures and to store, for said at least one of said one or 
more data structures, said one or more observation records and 
said one or more characterization records. 

151. (Preciously Presented) The apparatus of claim 149, wherein 
said one or more characteristics of said one or more 
transmission events are one or more of: a period during which a 
transmission event of said one or more transmission events is 
occurred, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event. 

152. (Preciously Presented) The apparatus of claim 14 9, wherein 
said at least one of said one or more characterization records 
is an index created using said one or more observation records. 

153. (Preciously Presented) The apparatus of claim 148, further 
comprising: 

a memory, configured to store said one or more data 
structures comprising corresponding said one or more 
characterization records. 

154. (Preciously Presented) The apparatus of claim 151, wherein 
said memory is a non-volatile memory or a data storage. 
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155. (Preciously Presented) The apparatus of claim 151, wherein 
said one or more data structures with corresponding 
characterization records are stored as a file system or as a 
hierarchical file system. 

156. (Preciously Presented) The apparatus of claim 148, wherein 
said location or said locations of the one or more data elements 
are in said at least one data structure of said one or more data 
structures . 

157. (Preciously Presented) The apparatus of claim 148, wherein 
said one or more data elements are stored within said at least 
one data structure. 

158. (Preciously Presented) The apparatus of claim 148, wherein 
said at least one of said one or more characterization records 
is an index comprising one or more of: a type of or an 
importance level for a transmission event of said one or more 
transmission events of said plurality of the transmission 
events, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event, and an internet 
protocol address of a node of said one or more nodes being a 
destination of said transmission event. 

159. (Currently Amended) The apparatus of claim 148, wherein 
said at least one of said one or more characterization records 
is an index indicating how to enter said location or locations 
of one or more data elements comprising at least one of said one 
or more transmission events unabridged. 

160. (Preciously Presented) The apparatus of claim 148, wherein 
said one or more characterization records comprise a summary of 



CIO ' , . N \ 111 49 i 



8 



Application No. 10/727,193 



Docket No: EMC-lOl(US) 



said one or more transmission events of said plurality of the 
transmission events. 

161. (Preciously Presented) The apparatus of claim 148, wherein 
at least one of said plurality of the transmission events is a 
notification. 

162. (Preciously Presented) The apparatus of claim 14 8, wherein 
said one or more data elements comprise partial or complete data 
comprised in said at least one of the one or more transmission 
events . 

163. (Preciously Presented) The apparatus of claim 148, wherein 
one of said one or more characterization records comprise an 
aggregate summary of said at least one data structure and one or 
more of other data structures of said one or more data 
structures . 

164. (Preciously Presented) The apparatus of claim 148, wherein 
all or selected transmission events of said plurality of the 
transmission events are notifications provided by all or 
selected nodes of said one or more nodes of said network. 

165. (Preciously Presented) The apparatus of claim 148, wherein 
said location or said locations of the one or more data elements 
are in said at least one data structure of said one or more data 
structures . 

166. (Currently Amended) A computer software product, comprising 
a computer-usable medium having computer readable instructions 
stored thereon for execution by a processor to perform a 
method comprising: 
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collecting a plurality of transmission events provided by 
one or more nodes of a network into one or more data 
structures; and 

creating one or more characterization records for at least 
one data structure of said one or more data structures, one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures, wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements stored in said one or more data structures and 
comprising a substantive content or a message comprised in at 
least one of said one or more transmission events, to allow 
accessing said at least one of the one or more characterization 
records to determine said one or more indicators of the location 
or locations of said one or more data elements. 

167. (Preciously Presented) The computer software product of 
claim 166, wherein said one or more data elements are stored 
within said at least one data structure. 

168. (Preciously Presented) The computer software product of 
claim 166, wherein said collecting comprises creating 
observation records of said plurality of the transmission events 
and storing said observation records in said one or more data 
structures, such that said at least one data structure of said 
one or more data structures comprises one or more observation 
records of said observation records created using one or more 
transmission events of said plurality of the transmission 
events, said one or more observation records being generated 
using one or more characteristics of said one or more 
transmission events in order to allow entering said one or more 
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observation records to determine whether at least one of said 
one or more characteristics is present in said at least one data 
structure . 

169. (Preciously Presented) The computer software product of 
claim 168, wherein said one or more characteristics of said one 
or more transmission events are one or more of: a period during 
which a transmission event of said one or more transmission 
events is occurred, and an internet protocol address of a node 
of said one or more nodes transmitted said transmission event. 

170. (Preciously Presented) The computer software product of 
claim 168, wherein said at least one of said one or more 
characterization records is an index created using said one or 
more observation records. 

171. (Preciously Presented) The computer software product of 
claim 166, wherein said at least one of said one or more 
characterization records is an index comprising one or more of: 
a type of or an importance level for a transmission event of 
said one or more transmission events of said plurality of the 
transmission events, an internet protocol address of a node of 
said one or more nodes transmitted said transmission event, and 
an internet protocol address of a node of said one or more nodes 
being a destination of said transmission event. 

172. (Currently Amended) The computer software product of claim 
166, wherein said at least one of said one or more 
characterization records is an index indicating how to enter 
said location or locations of one or more data elements 
comprising at least one of said one or more transmission events 
unabridged. 
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173. (Preciously Presented) The computer software product of 
claim 166, wherein said one or more characterization records 
comprise a summary of said one or more transmission events of 
said plurality of the transmission events. 

174. (Preciously Presented) The computer software product of 
claim 166, wherein at least one of said plurality of the 
transmission events is a notification. 

175. (Preciously Presented) The computer software product of 
claim 166, wherein said one or more data elements comprise 
partial or complete data comprised in said at least one of the 
one or more transmission events. 

176. (Preciously Presented) The computer software product of 
claim 166, wherein said method further comprises: 

storing said one or more data structures comprising 
corresponding said one or more characterization records in a 
memory, in a non-volatile memory or in a data storage. 

177. (Preciously Presented) The computer software product of 
claim 166, wherein said method further comprises: 

storing said one or more data structures with corresponding 
characterization records as a file system or as a hierarchical 
file system. 

178. (Preciously Presented) The computer software product of 
claim 166, wherein one of said one or more characterization 
records comprise an aggregate summary of said at least one data 
structure and one or more of other data structures of said one 
or more data structures. 
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179. (Preciously Presented) The computer software product of 
claim 164, wherein all or selected transmission events of said 
plurality of the transmission events are notifications provided 
by all or selected nodes of said one or more nodes of said 
network . 

180. (Preciously Presented) The computer software product of 
claim 166, wherein said location or said locations of the one or 
more data elements are in said at least one data structure of 
said one or more data structures. 

181. (Preciously Presented) The computer software product of 
claim 166, wherein said method further comprises: 

performing compression of said at least one data structure. 

182. (Preciously Presented) The computer software product of 
claim 166, wherein said method further comprises: 

creating a digital signature of said at least one data 
structure . 
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